Cyber-Protecting the 21st Century Workforce
used with the permission of https://thenetwork.cisco.com
by Jason Deign
Today’s workers are more mobile, free, and flexible than ever before. That makes them harder to protect from IT threats.
Ori Levi apologized as he took the stage at an October 2017 CryptoFriends Netup meeting in Barcelona. He had been up until 6 a.m. the night before, he said, and wasn’t used to public speaking.
Never mind: his speech raised eyebrows among the investors and blockchain experts at the event.
He was there to present Gladius, a venture that aims to use the blockchain to reward PC users for hiring out spare network bandwidth that can be used to deflect distributed-denial-of-service (DDoS) attacks. With millions of users, the Gladius network could sponge up threats at low cost.
Paying household Internet users to help fight cyber crime might sound extreme. But companies today need all the help they can get. DDoS attacks are leading to losses of US$150 billion a year, Levi said. The average attack costs $500,000.
And DDoS attacks are just one of many threats now present in the IT world. In May 2017, hundreds of thousands of computers worldwide were hit by WannaCry, a type of malware that locks users out of their own systems until a ransom is paid.
Along with ransomware such as WannaCry, users must fight off viruses, worms, Trojan horses, spyware, phishing attacks, and a growing host of other online dangers. The way modern workers go about their jobs is not helping, either.
Go back a decade or two, and your staff would spend most of their time in your office, working on the IT systems and endpoints you gave them. That made it easy for you to build a wall around your people, cutting them off from the IT threats in the wider world.
That’s all changed, though. Progress in mobile tech means your people can now work from any place they want. Thanks to the bring-your-own-device trend, they also work with handsets they have bought themselves, not the ones you’ve given them.
With the cloud you may no longer even host your own systems within your firewall. On top of that, as more and more endpoints become part of the network through the Internet of Things, the number of fronts that are open to attack gets bigger and bigger every day.
As Brian Roddy, head of cloud security at Cisco, points out: “10 years ago, applications used to be in a corporate headquarters, and access to the Internet would be protected by a stack of security technologies. Now people will find it easier to connect via 5G.”
In the most threat-filled world we have ever seen, your people are more exposed than ever before. What can you do about it?
“What has become increasingly apparent is that a perimeter approach to data protection simply isn’t effective anymore,” says Thomas Fischer, global security advocate at Digital Guardian, a data loss prevention firm.
“As workforces become more mobile and IT departments continue to be squeezed, it is crucial for businesses to ensure data is automatically protected no matter where it is or where it goes,” he says.
At Cisco, this means securing traffic to the cloud by means of technologies such as the Cisco Umbrella Secure Internet Gateway, and securing traffic from it via security brokers such as Cisco Cloudlock, Roddy says.
“What we’re really trying to do is replace the stack of technologies that used to be in the head office with a similar stack in the cloud,” he says.
In the face of common cyber threats such as phishing and ransomware, you must also adopt a “patch early, patch often” mantra, Fischer claims. You should review system settings and shut off any points that may leave them open to attack.
Keeping IT systems always up to date and free from known weak spots is vital. You need to step up efforts to inform remote workers about attacks via Short Message Service and smartphone apps.
It’s good practice to deploy software that can warn staff when a program attempts to download a file from the Internet or write a file to disk. Prompts can also help train users to spot and report attacks in progress.
And those tasked with keeping workers safe should be aware of new cyber security trends. In June, for instance, Cisco lifted the lid on a way of spotting malware hidden in encrypted traffic.
Despite this, says Fischer, “Hackers will, at some point, breach a network. At this point, the focus must shift to prevent hackers from exfiltrating data.”
By stopping people from being able to copy, move, or delete data, you can not only thwart IT attacks but also prevent staff from getting rid of things by mistake. It is likely not all the data in your firm would merit this treatment, of course.
That is why, when it comes to blocking cyber threats, “it’s not one size fits all,” says Menelaos Ioannidis, chief technology officer at Lightsource Labs, the research arm of one of the world’s largest solar plant asset holders.
Keeping staff safe online is “a continuous process” that demands “continuous investment,” he says.
It’s also a process where the actions of workers themselves can have a big impact.
Roddy at Cisco says: “We now have a rich set of tools to protect the cloud and its users. But we are sensitive to the fact that there is a human element in all this, so there is a big push around ease of deployment and ease of management.”
Cybersecurity is “everyone’s responsibility,” says Roddy. October was National Cyber Security Awareness Month, but the need to stay alert is for good.
